{
  "contract_version": "1.0.0",
  "incident": "INC-05",
  "incident_www_defect": "CLOSED_IN_DATED_SNAPSHOT",
  "surface": {
    "name": "Origin lock RECORD",
    "url": "https://a11oy.net/origin/",
    "contract": "https://a11oy.net/origin.json",
    "publisher": "SZL Holdings",
    "implementation": "static GitHub Pages document",
    "meaning": "Dated historical public-identity-host probe without attached response transcripts. Current host status is UNKNOWN until a new source-bound readback. Not DNS control. Not a Cloudflare API. Not product runtime. Not a fourth origin. A Grok working copy is not published here."
  },
  "observed_at_utc": "2026-09-26T01:52:00Z",
  "prior_observed_at_utc": "2026-09-26T01:10:00Z",
  "evidence_class": "SNAPSHOT",
  "status": {
    "state": "HISTORICAL",
    "current_state": "UNKNOWN"
  },
  "observer": "Public HTTP GET of /honest, /api/a11oy/v1/honest, a11oy.net/origin.json, and GitHub main from a stephenlutar2-hash session. Cloudflare API UNAVAILABLE. Operator computer UNAVAILABLE.",
  "hosts": [
    {
      "id": "product",
      "host": "a-11-oy.com",
      "role": "product apex",
      "status": 200,
      "front": "CLOUDFLARE",
      "a_records": [
        "104.21.27.230",
        "172.67.169.206"
      ],
      "server": "szl",
      "x_szl_space": "a11oy",
      "x_szl_wire_d": "LIVE",
      "wire_d_meaning": "Provenance hop from szl_provenance. Not domain LIVE. Do not conflate.",
      "git_sha_honest": "c1fa227e0c7c26d47c2f3c5ecaca7bfebb66dd64",
      "honesty": "SNAPSHOT",
      "verdict": "ADMIT",
      "note": "Orange-cloud in front of Space SZLHOLDINGS/a11oy. Apex reachable. HTTP 200 is reachability, not a production certificate. honest.git_sha c1fa227e MATCH this origin recapture. Does NOT MATCH GitHub szl-holdings/a11oy main 99df882c (LAG-6, 1 commit). Jev /status not re-probed in this recapture. Do not stamp LIVE. MATCH is not LIVE."
    },
    {
      "id": "www",
      "host": "www.a-11-oy.com",
      "role": "product www",
      "status": 301,
      "front": "CLOUDFLARE",
      "location": "https://a-11-oy.com/",
      "tls": {
        "handshake": "OK",
        "subject_cn": "a-11-oy.com",
        "issuer": "Google Trust Services WE1",
        "not_before": "2026-08-25T18:20:39Z",
        "not_after": "2026-11-23T19:18:12Z"
      },
      "hsts": "max-age=63072000; includeSubDomains",
      "server": "cloudflare",
      "honesty": "SNAPSHOT",
      "verdict": "ADMIT",
      "note": "Prior lock 2026-08-29 recorded Cloudflare HTTP 404. Prior recapture 2026-09-11T19:04Z recorded tlsv1 alert access denied. This probe: TLS OK, HTTP/2 301 to apex. Do not add www as a second Hugging Face custom domain. This RECORD does not mint DNS."
    },
    {
      "id": "proof",
      "host": "a11oy.net",
      "role": "proof registry",
      "status": 200,
      "front": "GITHUB_PAGES",
      "a_records": [
        "185.199.108.153",
        "185.199.109.153",
        "185.199.110.153",
        "185.199.111.153"
      ],
      "server": "GitHub.com",
      "honesty": "SNAPSHOT",
      "verdict": "ADMIT",
      "note": "Live A records are GitHub Pages. Separate failure domain. Do not 301 onto the product origin. _headers is policy intent; GitHub Pages does not apply it."
    },
    {
      "id": "forbidden",
      "host": "unhyphenated third-party furniture host",
      "role": "not ours",
      "status": 200,
      "front": "OTHER",
      "honesty": "SNAPSHOT",
      "verdict": "BLOCKED",
      "note": "Foreign storefront. Never canonical, never og:url, never sameAs, never a redirect target."
    }
  ],
  "huggingface": {
    "space": "SZLHOLDINGS/a11oy",
    "runtime_stage": "RUNNING",
    "runtime_sha_reported": "26d66c37080fae22ea682ea7768c6e3d19cb09b5",
    "runtime_sha_note": "Hugging Face spaces runtime SHA is a provider object. Product /honest git_sha c1fa227e does not match GitHub main 99df882c. Do not treat the provider runtime SHA as the product identity.",
    "spaces_author_api_count": 22,
    "spaces_author_api_observed_at": "2026-09-25T16:26:12Z",
    "spaces_sampled_running": 21,
    "spaces_sampled_running_note": "21 RUNNING was not re-sampled on 2026-09-26. Author-list is 22. Do not infer the 22nd is RUNNING.",
    "domains": [
      {
        "domain": "szlholdings-a11oy.hf.space",
        "stage": "READY"
      },
      {
        "domain": "a-11-oy.com",
        "stage": "READY"
      }
    ],
    "packet8_assurance_spaces": {
      "ids": [
        "SZLHOLDINGS/terra-assurance",
        "SZLHOLDINGS/aegis-assurance",
        "SZLHOLDINGS/puriq-markets",
        "SZLHOLDINGS/counsel-assurance"
      ],
      "public_probe": "HTTP 401",
      "note": "PACKET8.json initial_spaces_are_nonpublic true. 401 is the published contract, not a missing product desk. Product desks remain a-11-oy.com/{terra,aegis,puriq-markets,counsel,vessels}."
    },
    "note": "Space RUNNING and custom-domain READY are reachability. They are not production_ready and not a LIVE stamp. Unauthenticated author-list 2026-09-25T16:26:12Z is 22 Spaces / 49 models / 35 datasets."
  },
  "signer": {
    "healthz": "ABSENT",
    "scheme": "UNAVAILABLE",
    "note": "Only the rollup may stamp DSSE-LIVE when a live key is present. Do not copy LIVE from x-szl-wire-d."
  },
  "jev_gate": {
    "status_path": "https://a-11-oy.com/api/a11oy/v1/jev/status",
    "schema": "szl.jev_gate/v1",
    "engine_bound": false,
    "engine_honesty": "UNAVAILABLE",
    "promotion": "denied",
    "estate_gate": "HOLD",
    "agi_claim": false,
    "trust_ceiling": 0.97,
    "note": "Jev routes landed with a11oy#2272. TYPESAFE_API_KEY unset. SOFTWARE fallback. Code owns promotion. HTTP 200 is not LIVE."
  },
  "vessels_packet8": {
    "evaluate_path": "https://a-11-oy.com/api/a11oy/v1/decision/vessels/evaluate",
    "match": "3/3",
    "cases": [
      {
        "eval_id": "VESSELS-E-ABSTAIN",
        "case_id": "vessels-stale-list",
        "state": "ABSTAINED",
        "reason_codes": [
          "STALE_OR_UNAVAILABLE_SOURCE"
        ],
        "receipt_digest": "ec8868f29dea05cd9fe94c74fd765a1914d6545c0f11db7f48c3752f9eb86458"
      },
      {
        "eval_id": "VESSELS-E-AWAIT-01",
        "case_id": "vessels-aurora-wave",
        "state": "AWAITING_APPROVAL",
        "reason_codes": [
          "HUMAN_APPROVAL_REQUIRED"
        ],
        "receipt_digest": "ae6e3fc7fdc6fb28e62040926d474848b729f31ef3fda7a4253575880638e5be"
      },
      {
        "eval_id": "VESSELS-E-DENY-AIS",
        "case_id": "vessels-licensed-ais",
        "state": "DENIED",
        "reason_codes": [
          "PROHIBITED_ACTION"
        ],
        "receipt_digest": "0829bcbcd01154d383dca25ff996a8a4704e3183bbce00b393e0426a91bd9275"
      }
    ],
    "licensed_ais_admitted": false,
    "licensed_ais_queries": 0,
    "ais_standards": "CITATION_ONLY",
    "ais_lattice": {
      "honesty": "CITATION_ONLY",
      "surface": "https://a11oy.net/vessels/ais-lattice.json",
      "html": "https://a11oy.net/vessels/lattice/",
      "digest": "f931b48544bcf70b1ca0d1c03b38b6c8e9dbf1933adfb8128316324e82eeb457",
      "message_types": 27,
      "note": "Types are authority classes. Cite admitted. Live query DENIED. Lattice classify is not the Packet 8 kernel."
    },
    "vessels_e03": "OUTSTANDING",
    "formula_authority": "NONE",
    "production_ready": false,
    "stamps_live": false,
    "vertical_live_match": {
      "terra": "6/6",
      "aegis": "4/4",
      "puriq-markets": "4/4",
      "counsel": "4/4",
      "vessels": "3/3",
      "total": "21/21",
      "bind": "inner frozen payload"
    },
    "eval_id_only_probe": {
      "posted": {
        "eval_id": "VESSELS-E-DENY-AIS"
      },
      "state": "DENIED",
      "reason_codes": [
        "PROHIBITED_ACTION"
      ],
      "receipt_digest": "0829bcbcd01154d383dca25ff996a8a4704e3183bbce00b393e0426a91bd9275",
      "empty_json": {
        "state": "UNKNOWN",
        "reason_codes": [
          "EMPTY_KERNEL_BIND"
        ]
      },
      "note": "Product #2209 unwrap is live on a-11-oy.com. Wrapper-only empty POST stays UNKNOWN."
    },
    "note": "Evaluate MATCH is seed-policy replay of the inner frozen payload. It does not close entity-resolution E01 or licensed-AIS TPR E03. Wrapper-only POST without payload is not the eval contract.",
    "public_lists_world": {
      "honesty": "CITATION_ONLY",
      "surface": "https://a11oy.net/vessels/public-lists-world.json",
      "html": "https://a11oy.net/vessels/world/",
      "digest": "70fd1918fb38791159cfa2c520dc989f32125e4e0de4104b59d0a26fa48e1cb5",
      "lists": 50,
      "measured_200_or_206": 45,
      "note": "Proof-origin clocks. Product public_lists_echo is live on evaluate. HTTP 200 is reachability, not E01."
    },
    "public_list_lattice": {
      "honesty": "CITATION_ONLY",
      "surface": "https://a11oy.net/vessels/public-list-lattice.json",
      "digest": "b2d23ac69631667c09a8e3c4715d9a7caabda23edc9739b74d743fe6d9f88c1d",
      "authority_classes": 7
    },
    "joint_freshness": {
      "honesty": "CITATION_ONLY",
      "surface": "https://a11oy.net/vessels/joint-freshness.json",
      "html": "https://a11oy.net/vessels/world/",
      "digest": "1cb5b1178b7cda2327443eb7b8e33703aae26a23b4102a0d5f91291cff149898",
      "proof_http": 200,
      "product_echo_live": true,
      "product_github_main": "28acdc52f6f7f29c59216a64b9748f5f8a7aa72d",
      "honest_git_sha": "28acdc52f6f7f29c59216a64b9748f5f8a7aa72d",
      "note": "Proof JSON is live. Product evaluate echo is MEASURED. Product /honest MATCH GitHub main 28acdc52. Miss is not clearance."
    }
  },
  "defects": [
    {
      "id": "INC-05-ORIGIN-SHA-LAG-6",
      "host": "a11oy.net/origin.json",
      "prior": "git_sha_honest 28acdc52 MATCH main 28acdc52 at 2026-09-26T01:10:00Z",
      "now": "product /honest c1fa227e is merge #2277 on the Space. GitHub main is 99df882c (label overclaim fallback). This recapture matches honest, not main. Pages HTTP 200 is reachability.",
      "class": "SNAPSHOT",
      "closed_at_utc": null
    }
  ],
  "defects_closed": [
    {
      "id": "INC-05-WWW-404",
      "host": "www.a-11-oy.com",
      "prior": "Cloudflare HTTP 404 / later TLS access denied",
      "now": "TLS OK + HTTP/2 301 to https://a-11-oy.com/",
      "class": "SNAPSHOT",
      "closed_at_utc": "2026-09-11T23:25:17Z"
    },
    {
      "id": "INC-05-HF-DOMAIN-PENDING",
      "host": "a-11-oy.com",
      "prior": "Hugging Face runtime.domains stage PENDING",
      "now": "READY",
      "class": "SNAPSHOT",
      "closed_at_utc": "2026-09-11T23:25:17Z"
    },
    {
      "id": "INC-05-ORIGIN-SHA-LAG",
      "host": "a11oy.net/origin.json",
      "prior": "git_sha_honest 7253ccb1 while product honest a2244bde",
      "now": "closed then reopened when product moved to db9333c4",
      "class": "SNAPSHOT",
      "closed_at_utc": "2026-09-20T00:30:00Z"
    },
    {
      "id": "INC-05-ORIGIN-SHA-LAG-2",
      "host": "a11oy.net/origin.json",
      "prior": "git_sha_honest a2244bde while product honest db9333c4",
      "now": "git_sha_honest db9333c4 MATCH product and GitHub main",
      "class": "SNAPSHOT",
      "closed_at_utc": "2026-09-20T02:30:00Z"
    },
    {
      "id": "VESSELS-LATTICE-RECEIPT-UNBOUND",
      "host": "a11oy.net/vessels/receipt.json",
      "prior": "ais-lattice.json published; vessels.json permalink present; receipt.json and vessels/index.html did not bind the digest",
      "now": "receipt and human page bind lattice digest f931b485… · 27 types · CITATION_ONLY",
      "class": "SNAPSHOT",
      "closed_at_utc": "2026-09-20T02:30:00Z"
    },
    {
      "id": "INC-05-ORIGIN-SHA-LAG-3",
      "host": "a11oy.net/origin.json",
      "prior": "git_sha_honest db9333c4 while product honest moved through 4e4a0c66 to e48278b0",
      "now": "git_sha_honest e48278b0 MATCH product /honest and GitHub main",
      "class": "SNAPSHOT",
      "closed_at_utc": "2026-09-20T15:48:00Z"
    },
    {
      "id": "VESSELS-WORLD-CLOCKS-UNBOUND",
      "host": "a11oy.net/vessels/",
      "prior": "CN/KR/UA JSON live; world clocks authored on a branch; human vessels page only showed OFAC",
      "now": "world clocks + public-list authority lattice bound. digest 70fd1918… / b2d23ac6… · AIS lattice f931b485… unchanged",
      "class": "SNAPSHOT",
      "closed_at_utc": "2026-09-20T15:48:00Z"
    },
    {
      "id": "VESSELS-FLOW-SHELL-WORLD-UNBOUND",
      "host": "a11oy.net/vessels/world/",
      "prior": "vessels/world/index.html and vessels/lattice/index.html existed; frontend-flow-shell-state and holographic v2 rollout-state omitted them",
      "now": "both bound. min-link joint-freshness digest 1cb5b117… published. world digest 70fd1918… and AIS lattice f931b485… unchanged",
      "class": "SNAPSHOT",
      "closed_at_utc": "2026-09-20T16:05:00Z"
    },
    {
      "id": "INC-05-ORIGIN-SHA-LAG-4",
      "host": "a11oy.net/origin.json",
      "prior": "git_sha_honest e48278b0 while product honest moved through c98ca99 / 65b631e8; GitHub main is 3ee1b9b9",
      "now": "CLOSED_VERIFIED 2026-09-24 when honest briefly matched main. Recapture 2026-09-25 measures a new lag.",
      "class": "SNAPSHOT",
      "closed_at_utc": "2026-09-24T21:54:34Z"
    },
    {
      "id": "INC-05-ORIGIN-SHA-LAG-5",
      "host": "a11oy.net/origin.json",
      "prior": "git_sha_honest 15313677 while GitHub main was named 192dbcf1",
      "now": "CLOSED_VERIFIED. honest.git_sha 28acdc52 MATCH GitHub main 28acdc52. Jev routes live. Do not stamp LIVE.",
      "class": "SNAPSHOT",
      "closed_at_utc": "2026-09-26T01:10:00Z"
    }
  ],
  "holds": [
    "VESSELS-E01 IMO/vessel/owner entity resolution OUTSTANDING",
    "VESSELS-E03 licensed AIS true-positive rate OUTSTANDING",
    "AEGIS-E01 asset/identity entity-resolution precision OUTSTANDING",
    "licensed AIS CLOSED without a live key",
    "signer ABSENT / scheme UNAVAILABLE",
    "production_ready false",
    "Lambda Conjecture 1 OPEN",
    "formula authority NONE"
  ],
  "operator_actions": [
    "Keep www as a Cloudflare 301 to apex. Do not add www as a second Hugging Face custom domain.",
    "Keep orange-cloud on the product apex. READY is already measured; do not grey-cloud.",
    "Optional: _huggingface.a-11-oy.com TXT without dropping that proxy.",
    "Optional: orange-cloud a11oy.net only if Cloudflare should sit in front of GitHub Pages. Live DNS is Pages today.",
    "Do not stamp LIVE. Do not open a licensed AIS key from this RECORD.",
    "This proof origin does not change DNS. Product source does not change DNS."
  ],
  "related": {
    "factory_record": "https://a11oy.net/factory/",
    "product": "https://a-11-oy.com/",
    "vessels_product": "https://a-11-oy.com/vessels",
    "vessels_proof": "https://a11oy.net/vessels/",
    "vessels_lattice": "https://a11oy.net/vessels/ais-lattice.json",
    "vessels_lattice_html": "https://a11oy.net/vessels/lattice/",
    "jev_status": "https://a-11-oy.com/api/a11oy/v1/jev/status",
    "recapture_note": "https://a11oy.net/notes/INC05_RECAPTURE_2026-09-20-1548.md",
    "prior_recapture_note": "https://a11oy.net/notes/INC05_RECAPTURE_2026-09-20-0230.md",
    "runbook": "https://github.com/szl-holdings/a11oy/blob/main/docs/runbook.md",
    "incident": "INC-05",
    "vessels_world": "https://a11oy.net/vessels/public-lists-world.json",
    "vessels_world_html": "https://a11oy.net/vessels/world/",
    "vessels_public_list_lattice": "https://a11oy.net/vessels/public-list-lattice.json",
    "vessels_joint_freshness": "https://a11oy.net/vessels/joint-freshness.json"
  },
  "boundaries": {
    "this_origin_is_not_a_product_host": true,
    "cloudflare_api_unavailable": true,
    "does_not_change_dns": true,
    "does_not_stamp_live": true,
    "does_not_clone_verify": true,
    "grok_spa_not_published_here": true,
    "fourth_public_origin_published": false,
    "http_response_proves_capability": false,
    "www_301_is_not_production_ready": true,
    "evaluate_match_is_not_e03": true,
    "lattice_is_not_the_kernel": true,
    "jev_is_not_authority": true
  }
}